Backup Health Check (3-2-1 Rule + 2025 Threat Protection)

The "3" in 3-2-1: You need at least 3 copies of your data—one primary working copy plus two backups.

Why? Single points of failure. If you only have your production data and one backup, a single disaster (fire, ransomware, hardware failure) could destroy both.

Real scenario: Office fire destroys server and the backup drive sitting next to it. No third copy = complete data loss.

Impact: Zero redundancy means 100% data loss from a single disaster.

If all your backups are in the same physical location as your production systems, what happens when that location becomes unavailable?

Fire, flood, theft, power outage, ransomware spreading through your network—all these threats affect everything in one location simultaneously.

Geographic separation is critical. At least one backup must be far enough away that a local disaster can't reach it.

Impact: Same location = 100% vulnerability to local disasters (fire, flood, theft, ransomware).

Don't put all your eggs in one basket—or all your backups on one type of storage.

If all your backups are on the same type of media (all hard drives, all tape, all cloud), a vulnerability in that technology affects everything.

Examples of media diversity: Local NAS + cloud storage. External drives + tape. Disk + object storage.

Impact: Media-specific failures (controller failure, ransomware exploiting cloud API, format obsolescence) can't wipe out all backups if you use different types.

A backup you've never tested is simultaneously working and broken—you won't know until you desperately need it.

45% of backups fail during actual restore attempts (Backblaze). Configuration errors, corrupted data, missing dependencies, incompatible formats, expired credentials...

The only way to know your backups work is to actually restore from them. Regularly. Quarterly minimum.

Impact: Discovering your backups don't work during a disaster = discovering you have no backups.

"I'll do it tomorrow" becomes "I'll do it next week" becomes "I haven't backed up in 3 months."

Manual backups sound fine until you're busy, you're on vacation, you're sick, or you simply forget. One missed backup is all it takes.

Automated backups run whether you remember or not. Daily, continuous, scheduled—they happen without human intervention.

Impact: Manual processes fail. Automation ensures backups happen consistently, reliably, on schedule.

89% of ransomware attacks now target backup repositories (Veeam 2025 Ransomware Trends Report). Why? Because ransomware operators know that if you can restore from backups, you won't pay the ransom.

Immutable backups use write-once-read-many (WORM) storage. Once written, they cannot be modified or deleted—not by you, not by ransomware, not by anyone—until a retention period expires.

Technologies: AWS S3 Object Lock, Azure Immutable Blobs, Backblaze B2 retention, tape storage.

Impact: Ransomware can encrypt your production data AND your regular backups. Immutable backups are your last line of defense.

Most backup failures are silent. The system reports "success" but the backup is corrupted, incomplete, or inaccessible.

Without automated monitoring, you won't discover the failure until disaster strikes and you try to restore—weeks or months after the backups stopped working.

Proper monitoring alerts you within 24 hours when backups fail, when storage fills up, when retention policies aren't met, when restore tests fail.

Impact: Early detection means you can fix backup failures before they matter. Silent failures mean discovering your backups don't work when it's too late.

Encryption is required by HIPAA and PCI-DSS, and is considered a necessary safeguard under GDPR Article 32 for most use cases. Unencrypted backups are also a security risk—if someone steals your backup media, they have your data.

You need encryption in two places:

• At rest: Backup files stored encrypted (AES-256 standard per FIPS 140-3)
• In transit: Encrypted while transferring to storage (TLS 1.2+)

Key management is critical: Store encryption keys separately from backups (otherwise anyone who steals backups also gets the keys).

Impact: Unencrypted backups = compliance violations, potential fines, data breaches from stolen media.

You know how to restore from backups. Great. But what happens when disaster strikes and you're unavailable? Sick, on vacation, hit by a bus, unreachable?

If only you know how to restore, your backups are effectively useless when you're not there.

Documented, tested recovery procedures mean anyone on your team (or an emergency consultant) can restore your systems following step-by-step instructions.

Documentation should include: Where backups are stored, how to access them, authentication credentials (stored securely), restore commands/procedures, validation steps, who to contact.

Impact: Bus factor = 1 means one person becoming unavailable during a crisis could mean your business can't recover.